Description
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation leading to full application takeover
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Valid Session component of Oracle Applications Platform Engineering permits a low‑privileged local user to compromise the application. The attacker can bypass normal session controls, alter or access sensitive data, and ultimately gain full control over the application, resulting in complete loss of confidentiality, integrity, and availability.

Affected Systems

Oracle’s Applications Platform Engineering part of Oracle E‑Business Suite, versions 12.2.3 through 12.2.15, is affected. Any installation of those versions running in an environment where local user accounts exist is at risk.

Risk and Exploitability

The CVSS 3.1 base score of 7.8 indicates a high‑risk vulnerability. EPSS is less than 1 % and the issue is not listed in CISA’s KEV catalog. Exploitation requires local logon to the infrastructure hosting Applications Platform Engineering; no remote interaction or user interface is necessary, making the attack path straightforward for an attacker who can access the host.

Generated by OpenCVE AI on October 22, 2026 at 01:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security update that addresses CVE‑2026‑87356, ensuring the applied patch contains the fix.
  • Restrict local accounts on the host running Applications Platform Engineering to the minimum privileges required for their function and enforce least privilege policies.
  • Enable detailed auditing and logging for the Valid Session component, regularly review logs for unauthorized session creation or manipulation.

Generated by OpenCVE AI on October 22, 2026 at 01:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Local Privilege Escalation via Valid Session in Oracle Applications Platform Engineering
Weaknesses CWE-640

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle applications Platform Engineering
CPEs cpe:2.3:a:oracle:applications_platform_engineering:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Platform Engineering
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Applications Platform Engineering
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:24:15.868Z

Reserved: 2026-09-08T21:49:12.413Z

Link: CVE-2026-87356

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:13.427

Modified: 2026-10-21T18:44:19.627

Link: CVE-2026-87356

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T01:45:14Z

Weaknesses
  • CWE-640

    Weak Password Recovery Mechanism for Forgotten Password